<!doctype html>

<html>
<head>
  <link rel="shortcut icon" href="static/images/favicon.ico" type="image/x-icon">
  <title>safeurl_test.js (Closure Library API Documentation - JavaScript)</title>
  <link rel="stylesheet" href="static/css/base.css">
  <link rel="stylesheet" href="static/css/doc.css">
  <link rel="stylesheet" href="static/css/sidetree.css">
  <link rel="stylesheet" href="static/css/prettify.css">

  <script>
     var _staticFilePath = "static/";
     var _typeTreeName = "goog";
     var _fileTreeName = "Source";
  </script>

  <script src="static/js/doc.js">
  </script>


  <meta charset="utf8">
</head>

<body onload="grokdoc.onLoad();">

<div id="header">
  <div class="g-section g-tpl-50-50 g-split">
    <div class="g-unit g-first">
      <a id="logo" href="index.html">Closure Library API Documentation</a>
    </div>

    <div class="g-unit">
      <div class="g-c">
        <strong>Go to class or file:</strong>
        <input type="text" id="ac">
      </div>
    </div>
  </div>
</div>

<div class="clear"></div>

<h2><a href="local_closure_goog_html_safeurl_test.js.html">safeurl_test.js</a></h2>

<pre class="prettyprint lang-js">
<a name="line1"></a>// Copyright 2013 The Closure Library Authors. All Rights Reserved.
<a name="line2"></a>//
<a name="line3"></a>// Licensed under the Apache License, Version 2.0 (the &quot;License&quot;);
<a name="line4"></a>// you may not use this file except in compliance with the License.
<a name="line5"></a>// You may obtain a copy of the License at
<a name="line6"></a>//
<a name="line7"></a>//      http://www.apache.org/licenses/LICENSE-2.0
<a name="line8"></a>//
<a name="line9"></a>// Unless required by applicable law or agreed to in writing, software
<a name="line10"></a>// distributed under the License is distributed on an &quot;AS-IS&quot; BASIS,
<a name="line11"></a>// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
<a name="line12"></a>// See the License for the specific language governing permissions and
<a name="line13"></a>// limitations under the License.
<a name="line14"></a>
<a name="line15"></a>/**
<a name="line16"></a> * @fileoverview Unit tests for goog.html.SafeUrl and its builders.
<a name="line17"></a> */
<a name="line18"></a>
<a name="line19"></a>goog.provide(&#39;goog.html.safeUrlTest&#39;);
<a name="line20"></a>
<a name="line21"></a>goog.require(&#39;goog.html.SafeUrl&#39;);
<a name="line22"></a>goog.require(&#39;goog.i18n.bidi.Dir&#39;);
<a name="line23"></a>goog.require(&#39;goog.string.Const&#39;);
<a name="line24"></a>goog.require(&#39;goog.testing.jsunit&#39;);
<a name="line25"></a>
<a name="line26"></a>goog.setTestOnly(&#39;goog.html.safeUrlTest&#39;);
<a name="line27"></a>
<a name="line28"></a>
<a name="line29"></a>
<a name="line30"></a>function testSafeUrl() {
<a name="line31"></a>  var safeUrl = goog.html.SafeUrl.fromConstant(
<a name="line32"></a>      goog.string.Const.from(&#39;javascript:trusted();&#39;));
<a name="line33"></a>  var extracted = goog.html.SafeUrl.unwrap(safeUrl);
<a name="line34"></a>  assertEquals(&#39;javascript:trusted();&#39;, extracted);
<a name="line35"></a>  assertEquals(&#39;javascript:trusted();&#39;, safeUrl.getTypedStringValue());
<a name="line36"></a>  assertEquals(&#39;SafeUrl{javascript:trusted();}&#39;, String(safeUrl));
<a name="line37"></a>
<a name="line38"></a>  // URLs are always LTR.
<a name="line39"></a>  assertEquals(goog.i18n.bidi.Dir.LTR, safeUrl.getDirection());
<a name="line40"></a>
<a name="line41"></a>  // Interface markers are present.
<a name="line42"></a>  assertTrue(safeUrl.implementsGoogStringTypedString);
<a name="line43"></a>  assertTrue(safeUrl.implementsGoogI18nBidiDirectionalString);
<a name="line44"></a>}
<a name="line45"></a>
<a name="line46"></a>
<a name="line47"></a>/** @suppress {checkTypes} */
<a name="line48"></a>function testUnwrap() {
<a name="line49"></a>  var evil = {};
<a name="line50"></a>  evil.safeUrlValueWithSecurityContract_googHtmlSecurityPrivate_ =
<a name="line51"></a>      &#39;&lt;script&gt;evil()&lt;/script&#39;;
<a name="line52"></a>  evil.SAFE_URL_TYPE_MARKER_GOOG_HTML_SECURITY_PRIVATE_ = {};
<a name="line53"></a>
<a name="line54"></a>  var exception = assertThrows(function() {
<a name="line55"></a>    goog.html.SafeUrl.unwrap(evil);
<a name="line56"></a>  });
<a name="line57"></a>  assertTrue(exception.message.indexOf(&#39;expected object of type SafeUrl&#39;) &gt; 0);
<a name="line58"></a>}
<a name="line59"></a>
<a name="line60"></a>
<a name="line61"></a>/**
<a name="line62"></a> * Assert that url passes through sanitization unchanged.
<a name="line63"></a> * @param {string|!goog.string.TypedString} url The URL to sanitize.
<a name="line64"></a> */
<a name="line65"></a>function assertGoodUrl(url) {
<a name="line66"></a>  var expected = url;
<a name="line67"></a>  if (url.implementsGoogStringTypedString) {
<a name="line68"></a>    expected = url.getTypedStringValue();
<a name="line69"></a>  }
<a name="line70"></a>  var safeUrl = goog.html.SafeUrl.sanitize(url);
<a name="line71"></a>  var extracted = goog.html.SafeUrl.unwrap(safeUrl);
<a name="line72"></a>  assertEquals(expected, extracted);
<a name="line73"></a>}
<a name="line74"></a>
<a name="line75"></a>
<a name="line76"></a>/**
<a name="line77"></a> * Assert that url fails sanitization.
<a name="line78"></a> * @param {string|!goog.string.TypedString} url The URL to sanitize.
<a name="line79"></a> */
<a name="line80"></a>function assertBadUrl(url) {
<a name="line81"></a>  assertEquals(
<a name="line82"></a>      goog.html.SafeUrl.INNOCUOUS_STRING,
<a name="line83"></a>      goog.html.SafeUrl.unwrap(
<a name="line84"></a>          goog.html.SafeUrl.sanitize(url)));
<a name="line85"></a>}
<a name="line86"></a>
<a name="line87"></a>
<a name="line88"></a>function testSafeUrlSanitize_validatesUrl() {
<a name="line89"></a>  // Whitelisted schemes.
<a name="line90"></a>  assertGoodUrl(&#39;http://example.com/&#39;);
<a name="line91"></a>  assertGoodUrl(&#39;https://example.com&#39;);
<a name="line92"></a>  assertGoodUrl(&#39;mailto:foo@example.com&#39;);
<a name="line93"></a>  // Scheme is case-insensitive
<a name="line94"></a>  assertGoodUrl(&#39;HTtp://example.com/&#39;);
<a name="line95"></a>  // Different URL components go through.
<a name="line96"></a>  assertGoodUrl(&#39;https://example.com/path?foo=bar#baz&#39;);
<a name="line97"></a>  // Scheme-less URL with authority.
<a name="line98"></a>  assertGoodUrl(&#39;//example.com/path&#39;);
<a name="line99"></a>  // Absolute path with no authority.
<a name="line100"></a>  assertGoodUrl(&#39;/path&#39;);
<a name="line101"></a>  assertGoodUrl(&#39;/path?foo=bar#baz&#39;);
<a name="line102"></a>  // Relative path.
<a name="line103"></a>  assertGoodUrl(&#39;path&#39;);
<a name="line104"></a>  assertGoodUrl(&#39;path?foo=bar#baz&#39;);
<a name="line105"></a>  assertGoodUrl(&#39;p//ath&#39;);
<a name="line106"></a>  assertGoodUrl(&#39;p//ath?foo=bar#baz&#39;);
<a name="line107"></a>  // Restricted characters (&#39;&amp;&#39;, &#39;:&#39;, \&#39;) after [/?#].
<a name="line108"></a>  assertGoodUrl(&#39;/&amp;&#39;);
<a name="line109"></a>  assertGoodUrl(&#39;?:&#39;);
<a name="line110"></a>
<a name="line111"></a>  // .sanitize() works on program constants.
<a name="line112"></a>  assertGoodUrl(goog.string.Const.from(&#39;http://example.com/&#39;));
<a name="line113"></a>
<a name="line114"></a>  // Non-whitelisted schemes.
<a name="line115"></a>  assertBadUrl(&#39;javascript:evil();&#39;);
<a name="line116"></a>  assertBadUrl(&#39;javascript:evil();//\nhttp://good.com/&#39;);
<a name="line117"></a>  assertBadUrl(&#39;data:blah&#39;);
<a name="line118"></a>  // Restricted characters before [/?#].
<a name="line119"></a>  assertBadUrl(&#39;&amp;&#39;);
<a name="line120"></a>  assertBadUrl(&#39;:&#39;);
<a name="line121"></a>  // &#39;\&#39; is not treated like &#39;/&#39;: no restricted characters allowed after it.
<a name="line122"></a>  assertBadUrl(&#39;\\:&#39;);
<a name="line123"></a>  // Regex anchored to the left: doesn&#39;t match on &#39;/:&#39;.
<a name="line124"></a>  assertBadUrl(&#39;:/:&#39;);
<a name="line125"></a>  // Regex multiline not enabled: first line would match but second one
<a name="line126"></a>  // wouldn&#39;t.
<a name="line127"></a>  assertBadUrl(&#39;path\n:&#39;);
<a name="line128"></a>
<a name="line129"></a>  // .sanitize() does not exempt values known to be program constants.
<a name="line130"></a>  assertBadUrl(goog.string.Const.from(&#39;data:blah&#39;));
<a name="line131"></a>}
<a name="line132"></a>
<a name="line133"></a>
<a name="line134"></a>/**
<a name="line135"></a> * Asserts that goog.html.SafeUrl.unwrap returns the expected string when the
<a name="line136"></a> * SafeUrl has been constructed by passing the given url to
<a name="line137"></a> * goog.html.SafeUrl.sanitize.
<a name="line138"></a> * @param {string} url The string to pass to goog.html.SafeUrl.sanitize.
<a name="line139"></a> * @param {string} expected The string representation that
<a name="line140"></a> *         goog.html.SafeUrl.unwrap should return.
<a name="line141"></a> */
<a name="line142"></a>function assertSanitizeEncodesTo(url, expected) {
<a name="line143"></a>  var safeUrl = goog.html.SafeUrl.sanitize(url);
<a name="line144"></a>  var actual = goog.html.SafeUrl.unwrap(safeUrl);
<a name="line145"></a>  assertEquals(
<a name="line146"></a>      &#39;SafeUrl.sanitize().unwrap() doesn\&#39;t return expected &#39; +
<a name="line147"></a>          &#39;percent-encoded string&#39;,
<a name="line148"></a>      expected,
<a name="line149"></a>      actual);
<a name="line150"></a>}
<a name="line151"></a>
<a name="line152"></a>
<a name="line153"></a>function testSafeUrlSanitize_percentEncodesUrl() {
<a name="line154"></a>  // &#39;%&#39; is preserved.
<a name="line155"></a>  assertSanitizeEncodesTo(&#39;%&#39;, &#39;%&#39;);
<a name="line156"></a>  assertSanitizeEncodesTo(&#39;%2F&#39;, &#39;%2F&#39;);
<a name="line157"></a>
<a name="line158"></a>  // Unreserved characters, RFC 3986.
<a name="line159"></a>  assertSanitizeEncodesTo(&#39;aA1-._~&#39;, &#39;aA1-._~&#39;);
<a name="line160"></a>
<a name="line161"></a>  // Reserved characters, RFC 3986. Only &#39;\&#39;&#39;, &#39;(&#39; and &#39;)&#39; are encoded.
<a name="line162"></a>  assertSanitizeEncodesTo(&#39;/:?#[]@!$&amp;\&#39;()*+,;=&#39;, &#39;/:?#[]@!$&amp;%27%28%29*+,;=&#39;);
<a name="line163"></a>
<a name="line164"></a>
<a name="line165"></a>  // Other ASCII characters, printable and non-printable.
<a name="line166"></a>  assertSanitizeEncodesTo(&#39;^&quot;\\`\x00\n\r\x7f&#39;, &#39;%5E%22%5C%60%00%0A%0D%7F&#39;);
<a name="line167"></a>
<a name="line168"></a>  // Codepoints which UTF-8 encode to 2 bytes.
<a name="line169"></a>  assertSanitizeEncodesTo(&#39;\u0080\u07ff&#39;, &#39;%C2%80%DF%BF&#39;);
<a name="line170"></a>
<a name="line171"></a>  // Highest codepoint which can be UTF-16 encoded using two bytes
<a name="line172"></a>  // (one code unit). Highest codepoint in basic multilingual plane and highest
<a name="line173"></a>  // that JavaScript can represent using \u.
<a name="line174"></a>  assertSanitizeEncodesTo(&#39;\uffff&#39;, &#39;%EF%BF%BF&#39;);
<a name="line175"></a>
<a name="line176"></a>  // Supplementary plane codepoint which UTF-16 and UTF-8 encode to 4 bytes.
<a name="line177"></a>  // Valid surrogate sequence.
<a name="line178"></a>  assertSanitizeEncodesTo(&#39;\ud800\udc00&#39;, &#39;%F0%90%80%80&#39;);
<a name="line179"></a>
<a name="line180"></a>  // Invalid lead/high surrogate.
<a name="line181"></a>  assertSanitizeEncodesTo(&#39;\udc00&#39;, goog.html.SafeUrl.INNOCUOUS_STRING);
<a name="line182"></a>
<a name="line183"></a>  // Invalid trail/low surrogate.
<a name="line184"></a>  assertSanitizeEncodesTo(&#39;\ud800\ud800&#39;, goog.html.SafeUrl.INNOCUOUS_STRING);
<a name="line185"></a>}
<a name="line186"></a>
<a name="line187"></a>
<a name="line188"></a>function testSafeUrlSanitize_idempotentForSafeUrlArgument() {
<a name="line189"></a>  // This goes through percent-encoding.
<a name="line190"></a>  var safeUrl = goog.html.SafeUrl.sanitize(&#39;%11&quot;&#39;);
<a name="line191"></a>  var safeUrl2 = goog.html.SafeUrl.sanitize(safeUrl);
<a name="line192"></a>  assertEquals(
<a name="line193"></a>      goog.html.SafeUrl.unwrap(safeUrl), goog.html.SafeUrl.unwrap(safeUrl2));
<a name="line194"></a>
<a name="line195"></a>  // This doesn&#39;t match the safe prefix, getting converted into an innocuous
<a name="line196"></a>  // string.
<a name="line197"></a>  safeUrl = goog.html.SafeUrl.sanitize(&#39;disallowed:foo&#39;);
<a name="line198"></a>  safeUrl2 = goog.html.SafeUrl.sanitize(safeUrl);
<a name="line199"></a>  assertEquals(
<a name="line200"></a>      goog.html.SafeUrl.unwrap(safeUrl), goog.html.SafeUrl.unwrap(safeUrl2));
<a name="line201"></a>}
</pre>


</body>
</html>
